> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP DNS Managed Zones Should Use Secure Algorithm

### More Info:

Ensure that Cloud DNS Managed Zones use secure algorithm for encryption.

### Risk Level

High

### Address

Security

### Compliance Standards

* NIST CSF
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "GCP DNS Managed Zones Should Use Secure Algorithm" for GCP using GCP console, follow these steps:

        1. Open the GCP console and select the project where the DNS Managed Zone is located.

        2. In the left-hand navigation menu, click on "Network services" and select "Cloud DNS".

        3. In the Cloud DNS dashboard, select the DNS Managed Zone that needs to be remediated.

        4. Click on the "Edit" button at the top of the page.

        5. In the "Zone details" section, select the "Advanced" tab.

        6. In the "DNSSEC" section, select the "Enable DNSSEC" checkbox.

        7. Select the "Algorithm" dropdown and choose a secure algorithm such as "RSASHA256".

        8. Click on the "Save" button at the bottom of the page to save the changes.

        9. Verify that the DNS Managed Zone is now using a secure algorithm by checking the "DNSSEC" section of the "Zone details" page.

        By following these steps, you have successfully remediated the misconfiguration "GCP DNS Managed Zones Should Use Secure Algorithm" for GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "GCP DNS Managed Zones Should Use Secure Algorithm" for GCP using GCP CLI, follow the steps given below:

        1. Open the GCP Cloud Shell by clicking on the Activate Cloud Shell icon on the top right corner of the GCP Console.

        2. Run the following command to list all the DNS managed zones in your GCP project:

        ```
        gcloud dns managed-zones list
        ```

        3. Identify the DNS managed zone that is using an insecure algorithm.

        4. Run the following command to update the DNS managed zone to use a secure algorithm:

        ```
        gcloud dns managed-zones update [ZONE_NAME] --dnssec-algorithm=RSASHA256
        ```

        Make sure to replace \[ZONE\_NAME] with the name of the DNS managed zone that you want to update.

        5. Verify that the DNS managed zone is updated to use a secure algorithm by running the following command:

        ```
        gcloud dns managed-zones describe [ZONE_NAME] | grep -i algorithm
        ```

        Make sure that the output shows the algorithm as "RSASHA256".

        By following these steps, you can remediate the misconfiguration "GCP DNS Managed Zones Should Use Secure Algorithm" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the GCP DNS Managed Zones Should Use Secure Algorithm misconfiguration, follow these steps:

        1. Install the Google Cloud SDK by following the instructions at [https://cloud.google.com/sdk/docs/install](https://cloud.google.com/sdk/docs/install).

        2. Set up authentication for the Google Cloud SDK by running `gcloud auth login` and following the instructions.

        3. Install the `google-cloud-dns` Python library by running `pip install google-cloud-dns`.

        4. Write a Python script to update the DNS managed zones to use a secure algorithm. Here's an example script:

        ```python theme={null}
        from google.cloud import dns

        # Set the project ID and managed zone name
        project_id = 'your-project-id'
        zone_name = 'your-zone-name'

        # Create a DNS client
        client = dns.Client(project=project_id)

        # Get the managed zone
        zone = client.zone(zone_name)

        # Update the DNSSEC algorithm
        zone.dnssec_config.algorithm = 'rsasha256'

        # Update the managed zone
        zone.update()

        print('Managed zone updated successfully.')
        ```

        Replace `your-project-id` and `your-zone-name` with your actual project ID and managed zone name.

        5. Run the Python script by running `python script.py`.

        This will update the DNS managed zone to use a secure algorithm (in this case, `rsasha256`). Repeat this process for all other DNS managed zones in your GCP project.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_dns_managed_zone" "SECURE_MANAGED_ZONE" {
          name        = "SECURE_MANAGED_ZONE_NAME"        # replace with your managed zone name
          dns_name    = "EXAMPLE_COM_DNS_NAME."           # e.g. "example.com."
          description = "Managed zone with secure DNSSEC algorithm"
          project     = "GCP_PROJECT_ID"                  # replace with your GCP project ID
          visibility  = "public"                          # or "private" as appropriate

          dnssec_config {
            state = "on"

            # Use a secure algorithm (avoid insecure/legacy ones like rsasha1)
            # Valid secure values include: "rsasha256", "rsasha512",
            # "ecdsap256sha256", "ecdsap384sha384"
            # Pick one that matches your policy; this example uses ECDSA P-256:
            default_key_specs {
              key_type  = "keySigning"
              algorithm = "ecdsap256sha256"
              key_length = 256
            }

            default_key_specs {
              key_type  = "zoneSigning"
              algorithm = "ecdsap256sha256"
              key_length = 256
            }
          }
        }
        ```

        Changing `dnssec_config` (including `state` and `algorithm`) is an in-place update for an existing managed zone; it does not force resource replacement but will trigger DNSSEC reconfiguration on the zone itself.

        To verify, `terraform plan` should show an update to the existing `google_dns_managed_zone` with changes only under `dnssec_config`, specifically the `state` set to `"on"` if it was off and the `default_key_specs.algorithm` fields changing from the previous (insecure/legacy) value to the chosen secure algorithm.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/dns/docs/dnssec-advanced](https://cloud.google.com/dns/docs/dnssec-advanced)